AI email assistant security checklist
An email assistant can see some of your most sensitive work. Evaluate the entire data flow—not only whether the vendor says it uses encryption.
Account access and permissions
Ask exactly which Gmail or Microsoft Graph permissions are requested and why each one is necessary. Determine whether the connection can read all mail, send mail, modify messages, or access contacts and calendars.
Confirm that access can be revoked from both the product and the identity provider. Prefer scoped, user-consented OAuth access over shared passwords or forwarded copies of every message.
Data flow and model providers
Request a plain-language diagram showing where message content goes, which model providers process it, the hosting regions involved, and where temporary or persistent copies exist.
Ask whether customer content is used for model training, human review, abuse monitoring, or product analytics. “We do not train our model” is incomplete if a subprocessor has different terms.
Retention, deletion, and backups
Find out how long raw messages, drafts, embeddings, logs, writing samples, and voice samples are kept. Retention should have a documented purpose and should differ between operational data and required audit records.
Deletion terms should explain production systems, backups, legal holds, and organization-controlled retention. Test the deletion process before storing sensitive information.
Drafting and sending controls
Determine whether the assistant can send automatically, what the default is, and whether sensitive categories are always held for review. Ask how it handles prompt injection inside received email, missing context, placeholders, and invented facts.
Look for visible source context, confidence limitations, approval records, and a fast way to disable connections or automation.
Organizational security
Ask about encryption in transit and at rest, role-based access, employee access, audit logging, incident response, vulnerability reporting, subprocessors, and business continuity.
Regulated organizations should evaluate contracts, BAAs or DPAs where applicable, minimum-necessary access, retention duties, and their own configuration. A product feature alone does not make a deployment compliant.
The 18-question shortlist
1. Which permissions are required? 2. Can we limit them? 3. How do we revoke access? 4. Where is data processed? 5. Which model providers receive it? 6. Is content used for training? 7. Is content reviewed by humans? 8. What is retained? 9. For how long? 10. How is deletion verified? 11. Are backups included? 12. Can the system auto-send? 13. Which messages always require review? 14. How is prompt injection handled? 15. Are approvals audited? 16. Which employees can access content? 17. What happens after an incident? 18. Which contract governs these answers?